VPN IPSec IKEv2 with ldap authentication + FortiToken : possible with the free VPN-only Client ?

[Nea]

Hello,

Seems we are forced to move from SSL to IPSEC VPN so we are actually trying it on our FTG901G v7.4.9

Our authentication is direct from the fortigate to Active Directory (ldaps)

It is working since we activated EAP-TTLS thank's to this trick : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-EAP-TTLS-for-IPSec-IKEv2-tun...

BUT, it is not working when we add a FortiToken on the account

I saw on this page that 2FA is supported from client v7.4.4 with IKEv2 ldap users : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Overview-of-compatible-IKE-versions-user/t...

The little stars lead us to this Technical Tip and this Special Notice which explain that there is no free version of the 7.4.4 Forticlient, BUT the 7.4.3 free VPN-only agent is supposed to do the same job :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multi-Factor-Authentication-support-for-Wi...

https://docs.fortinet.com/document/forticlient/7.4.4/windows-release-notes/683433/special-notices

I've read a lot of kb, tips and fortidocs but I'm still not sure to understand : are our FortiToken supposed to work in our situation ? :

VPN IPSec IKEv2 + ldaps auth (eap-ttls) + free VPN-only agent

[funkylicious]

hi,

have a look at https://community.fortinet.com/t5/FortiGate/Technical-Tip-Overview-of-compatible-IKE-versions-user/t... 

how is the FortiToken assigned to the user ? locally on the FGT , on FortiAuth or using FortiIdentity Cloud ?

[Nea]

Hi Funky,

FortiTokens are assigned locally on the FTG

[funkylicious]

then it should work in my opinion.

[Nea]

Even with 7.4.3 VPN-only free client ?

On the page you linked before, we can read that :

While FortiClient Windows v7.4.3 does support EAP-TTLS using XML configuration, it does not support combining EAP-TTLS with MFA.

[funkylicious]

i just tested in my lab w/ FCT 7.4.3 and it doesnt seem to work. I used a imported LDAP user and assigned 2FA with email and it gets ignored/doesnt prompt for token.

it connects but it doesnt seem that routing is done properly, so scratch what i've said about it working.

L.E. i've reinstalled FCT ( to get rid of incorrect routes ) but cannot fully test it since I dont have FGT 7.4.9 as  per https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multi-Factor-Authentication-support-for-Wi... 

[funkylicious]

I have managed to get it to work, but with FCT 7.4.4 ( i have the trial license for EMS ) and FortiOS 7.4.9 .

FortiClient 7.4.3 doesnt get the token prompt and cannot pass it using passwordToken concat, so it appears to be working only with 7.4.4 using IKEv2 . For IKEv1 it works with 7.4.3 just fine

[Nea]

Thank you very much for your tests.
We have the same result with client 7.4.3: it doesn't ask for the token.

IKEv1 is not an option because it is deprecated and will disappear from future versions.

We are not planning to purchase licenses for clients 
We need visibility to know which VPN solution to migrate our users to, and currently the new versions of FortiOS do not provide us any free solution.

[yderek]

@Nea  Isn't that you are using local user with MFA only ? Are you using EAP-TTLS  or just local user with MFA FortiTokens ?

[Nea]

The problem is with ldap users (EAP-TTLS since we are trying to move on IPSec)

With no Token : it is working

With the FortiTokens, it doesn't work : it isn't asking for the token

It results on Wrong credentials EAP fails (client side)